VulnWatch VulnWatch
← All articles
Weekly digest · Jun 8, 2026

VulnWatch Weekly: Agentic RCE Surge & Model Loading Risks

Critical vulnerabilities in Langroid, OpenMed, and MCP servers highlight escalating risks in AI agent tooling and model loading paths. Immediate patching required for agent frameworks and orchestration platforms.

Prompt Injection Remote Code Execution Auth Bypass Agentic / MCP

Week in Review: June 1-7, 2026

This week marks a significant escalation in the threat landscape for AI infrastructure, dominated by critical remote code execution (RCE) vulnerabilities in agent frameworks and model serving pipelines. The most urgent item is CVE-2026-25879 in Langroid, where prompt injection facilitates SQL-based RCE, fundamentally challenging the security of LLM-powered database agents. Across the board, we observe a pattern of insufficient sandboxing in autonomous coding agents and unsafe model loading practices in medical and general AI platforms. Security teams must prioritize patching agent orchestration layers and auditing model ingestion pipelines immediately.

Top Items of the Week

The following vulnerabilities represent the highest risk to AI/ML operations based on severity, exploitability, and potential impact on confidentiality and integrity.

  1. CVE-2026-25879 (Langroid)

    • Severity: Critical (CVSS 9.8)
    • Component: SQLChatAgent
    • Impact: Prompt injection allows attackers to coerce the agent into executing dialect-specific SQL primitives (e.g., COPY ... FROM PROGRAM), achieving RCE on the database host.
    • Action: Upgrade to version 0.63.0 or later immediately. Audit database roles assigned to agent service accounts and revoke privileges enabling code execution.
    • Source: NVD

  2. CVE-2026-47117 (OpenMed)

    • Severity: Critical (CVSS 9.3)
    • Component: PII Privacy-Filter Model Loading
    • Impact: Unauthenticated attackers can supply malicious model repositories that load custom Transformers code with trust_remote_code=True, executing arbitrary code with service privileges.
    • Action: Upgrade to version 1.5.2. Implement strict allowlisting for model repositories and disable trust_remote_code in production environments.
    • Source: NVD

  3. CVE-2026-41283 (OpenStack Mistral)

    • Severity: Critical (CVSS 9.9)
    • Component: API Endpoints
    • Impact: Arbitrary Remote Code Execution when the API is exposed, leading to exfiltration of service credentials.
    • Action: Upgrade to version 22.0.1 or later. Restrict API exposure to internal networks and enforce strict authentication mechanisms.
    • Source: NVD

  4. CVE-2026-32625 (LibreChat)

    • Severity: Critical (CVSS 9.6)
    • Component: Model Context Protocol (MCP) Server Integration
    • Impact: Authenticated users can create malicious MCP configurations that resolve environment variables, transmitting critical secrets (JWT_SECRET, CREDS_KEY) to attacker-controlled domains.
    • Action: Upgrade to version 0.8.4. Audit MCP server configurations and rotate any secrets potentially exposed via environment variable leakage.
    • Source: NVD

  5. CVE-2026-42074 (OpenClaude)

    • Severity: Critical (CVSS 9.3)
    • Component: BashTool Input Schema
    • Impact: The dangerouslyDisableSandbox parameter is exposed to the LLM, allowing prompt-injected models to escape the sandbox and achieve full host-level code execution.
    • Action: Upgrade to version 0.5.1. Ensure allowUnsandboxedCommands is set to false and audit tool schemas for sensitive parameters.
    • Source: NVD

  6. CVE-2026-4035 (MLflow)

    • Severity: Critical (CVSS 9.1)
    • Component: AI Gateway Secrets
    • Impact: Environment variable resolution in secrets allows low-privileged users to exfiltrate server-side credentials to attacker-controlled endpoints via upstream authentication headers.
    • Action: Upgrade to version 3.11.0. Review AI Gateway secret configurations and remove any $ENV_VAR references from api_key fields.
    • Source: NVD

  7. CVE-2026-5241 (Hugging Face Transformers)

    • Severity: High (CVSS 8.0)
    • Component: LightGlue Model Loading
    • Impact: trust_remote_code parameter is overridden by untrusted serialized configuration data, allowing arbitrary code execution during model initialization.
    • Action: Upgrade to version 5.2.1. Validate config.json files from untrusted sources before loading models.
    • Source: NVD

  8. GHSA-63gr-g7jc-v8rg (@agenticmail/mcp)

    • Severity: High
    • Component: Streamable HTTP Transport
    • Impact: Missing authentication on the /mcp endpoint allows remote clients to invoke master-only operations using the server's configured master key.
    • Action: Apply vendor patch immediately. Implement network-level access controls to restrict MCP HTTP ports to trusted clients only.
    • Source: GitHub

  9. CVE-2026-44211 (Cline)

    • Severity: Critical (CVSS 9.6)
    • Component: Kanban Servers
    • Impact: Cross-origin WebSocket hijack vulnerability allows attackers to intercept or manipulate agent communication channels. No public patch available at time of publication.
    • Action: Disable external Kanban integrations until a patch is released. Monitor WebSocket traffic for anomalous origin headers.
    • Source: NVD

  10. CVE-2026-9319 (IBM WebSphere)

    • Severity: Critical (CVSS 9.0)
    • Component: JAX-WS Endpoints
    • Impact: Deserialization of untrusted data via WS-Security endpoints allows potential remote code execution.
    • Action: Apply IBM security fixes for versions 9.0 and 8.5. Review WS-Security policies for strict type validation.
    • Source: NVD

The Agent Explosion & Tool Abuse

The dominant theme this week is the vulnerability of autonomous agents. As organizations deploy agents like Langroid, OpenClaude, and Cline to interact with external tools, the attack surface expands beyond the model itself to the tools these agents wield. CVE-2026-25879 in Langroid is a prime example of "indirect prompt injection" leading to infrastructure compromise. Here, the LLM is not just tricked into revealing data but is coerced into generating SQL that executes server-side programs. This highlights a critical design flaw: granting agents database roles with privileges like pg_execute_server_program violates the principle of least privilege.

Similarly, CVE-2026-42074 in OpenClaude exposes a dangerous parameter (dangerouslyDisableSandbox) directly to the model's input schema. In agentic architectures, the model is an untrusted principal; any configuration that allows the model to disable its own containment is a critical failure. We also see this in the MCP (Model Context Protocol) ecosystem. CVE-2026-32625 in LibreChat and GHSA-63gr-g7jc-v8rg in @agenticmail/mcp demonstrate how MCP servers, designed to connect agents to data sources, are becoming vectors for secret exfiltration and authentication bypass. The MCP specification is evolving rapidly, but security controls around server configuration and authentication are lagging. Teams using MCP should treat server configurations as code and scan them for environment variable references or unsafe connection strings.

Model Loading & Supply Chain RCE

The supply chain risk extends beyond Python dependencies to the models themselves. CVE-2026-47117 in OpenMed and CVE-2026-5241 in Hugging Face Transformers reveal persistent issues with trust_remote_code. In the OpenMed case, a substring matching vulnerability in the privacy-filter dispatcher allowed attackers to route requests to paths that loaded models with remote code execution enabled. This is particularly concerning in medical AI contexts where data sensitivity is paramount. The Transformers vulnerability shows that even when trust_remote_code=False is set explicitly in code, untrusted config.json files can override this setting during nested initialization.

This suggests that defense-in-depth is required at the infrastructure level, not just the application level. Model loading services should run in isolated sandboxes with no network egress and minimal filesystem access. Furthermore, model registries should enforce signing and verification of configuration files to prevent tampering. The prevalence of these issues indicates that the convenience of auto-loading custom code is outweighing security caution in many open-source projects.

Platform Leakage & IDOR Vulnerabilities

Orchestration platforms like LibreChat and MLflow are maturing, but their access control models are struggling to keep pace with feature complexity. We observed multiple Insecure Direct Object Reference (IDOR) vulnerabilities in LibreChat this week (CVE-2026-31942, CVE-2026-44653, CVE-2026-44654). These bugs allow users to manipulate API keys, view decrypted secrets, or delete files belonging to other users by simply modifying request parameters. CVE-2026-4035 in MLflow further exacerbates this by allowing environment variable resolution in secrets, effectively turning a low-privileged account into a credential harvesting tool.

These vulnerabilities stem from a common root cause: complex permission matrices in multi-tenant AI platforms. When features like "shared agents" or "workspace members" are added, developers often forget to propagate ownership checks to new endpoints. Security engineers should audit all "list" and "get" endpoints in their AI platforms to ensure that object ownership is validated against the authenticated user's context, not just their membership in a workspace.

Enterprise Copilot & Integration Risks

Enterprise integrations remain a high-risk area. Microsoft Copilot vulnerabilities (CVE-2026-45497, CVE-2026-42824, CVE-2026-47644) highlight the risks of connecting LLMs to productivity suites. Command injection and improper neutralization in Copilot allow attackers to execute code or disclose information over the network. Additionally, CVE-2026-11326 in OpenAI Atlas exposes privileged browser APIs to web content, allowing cross-site scripting attacks to access browser history. These issues remind us that AI wrappers around existing enterprise software inherit the vulnerabilities of both the AI layer and the underlying application. Integration points must be treated as trust boundaries where input validation is strictly enforced.

Known Exploited Status

No items were flagged as is_exploited=true in the wild this week. However, several vulnerabilities, particularly in SGLang (CVE-2026-10300, CVE-2026-10775) and MLflow (PYSEC-2026-195), have public proof-of-concept code available. This increases the likelihood of opportunistic scanning and exploitation in the coming weeks. Security teams should treat public PoCs as equivalent to active exploitation for prioritization purposes.

What to Do This Week

  1. Patch Agent Frameworks: Prioritize updates for Langroid, OpenClaude, and Cline. If patches are unavailable (e.g., Cline), disable external integrations.
  2. Audit Model Loading: Scan all model ingestion pipelines for trust_remote_code=True. Implement network egress restrictions for model loading services.
  3. Secure MCP Servers: Review all Model Context Protocol configurations. Ensure secrets are not passed via environment variables and that authentication is enforced on MCP endpoints.
  4. Rotate Credentials: For affected LibreChat and MLflow instances, assume secret leakage. Rotate API keys, JWT secrets, and database credentials immediately.
  5. Restrict Database Privileges: Ensure AI agents connecting to databases do not have privileges enabling code execution (e.g., FILE, xp_cmdshell, pg_execute_server_program).

What to Watch Next Week

Expect further disclosures related to the Model Context Protocol (MCP) as adoption grows and security research focuses on this new integration layer. We also anticipate more vulnerabilities in "auto-fix" coding agents as they are granted deeper access to development environments. Monitor advisories for updates on the Cline WebSocket hijack issue, as a patch is pending. Finally, keep an eye on MLflow and Transformers, as the supply chain vulnerabilities identified this week may have variants in other model loading libraries.

Covered entries (35)